CVE-2026-123527 Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass

Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background...

CVE-2026-123526 Vikunja before 2.7.1 Mass Assignment via Team external_id Field

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only externalid field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every memb...

qvm-create-windows-qube

Qvm-Create-Windows-Qube Spin up new Windows qubes quickly, effortlessly and securely About Qvm-Create-Windows-Qube is a tool for quickly and conveniently installing fresh new Windows qubes with Qubes Windows Tools QWT dr...

CVE_6387

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

CVE-2021-42392-exploit-lab

⚠️ H2 Database RCE Exploit PoC CVE-2021-42392 This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability CVE-2021-42392 using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly...

CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

EUVD-2026-118570

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress (versions up to and including 2.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the public /motopress/appointment/v1/customers/create REST endpoint, which lacks proper permission checks (permission_callback ...

CVE-2026-120741 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap Ask Bing DuckDuck GO UOL Yahoo Install git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using Ask from searchEngines.ask...

EUVD-2026-39805

LXD: SSRF via image import from URL allows internal network probing by authenticated users...

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Clo...

CVE-2026-122301

Parse Server versions prior to 8.6.114 and 9.0.0 prior to 9.10.6-alpha.6 are vulnerable to an Information Disclosure vulnerability via Object Create responses. The root cause is that the server returns field values to callers who lack read access to the created object based on class-level permiss...

EUVD-2026-117212

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Clo...

CVE-2026-122158

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

CVE-2026-122158 InvoiceShelf MemberService.php create access control

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

CVE-2026-122158 InvoiceShelf MemberService.php create access control

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

CVE-2026-122158

A security flaw in InvoiceShelf (versions up to 2.4.3/3.0.0-alpha.3) allows for improper access controls due to a vulnerability in the MemberService::create function within the app/Domains/Accounts/Application/MemberService.php file. By manipulating the companies[].id or companies[].role argument...

EUVD-2026-117210

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

PT-2026-137314

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...